Privacy notice · reviewed 1 September 2026
Know the boundary before you speak.
Voice Transcriber has no account, analytics, advertising, crash-report upload, project server, or automatic transcript sync. Your microphone still crosses boundaries you should choose deliberately.
The short version
| Surface | Default | Control |
|---|---|---|
| Microphone audio | Bounded memory; no recording file | Explicit Start/Stop and visible provider |
| Groq cloud | Completed segments only | Cloud consent and user-managed key |
| Local prototype | Unavailable | Explicit source flag plus user-supplied CLI/model |
| Transcript history | Off | Opt in, choose 1–365 days, delete one or all |
| Export | Nothing written | Choose and confirm one destination |
Groq cloud mode
Silence detection happens locally. When a speech segment closes, the app sends an in-memory WAV, model identifier, and language/translation choice to Groq over HTTPS. It does not use batch, file-storage, or fine-tuning APIs.
Groq controls processing after receipt. Review its current speech-to-text documentation, customer-data documentation, and privacy policy. Voice Transcriber does not make a provider-retention promise those documents may later invalidate.
Provider facts reviewed 1 September 2026. Groq said inference input/output was not retained by default, but could be logged for reliability or abuse review for up to 30 days. Zero Data Retention was available, and retained customer data was located in US GCP.
Speech requests had a 10-second minimum billed length. Voice Transcriber sends every completed speech segment as a separate request, so short segments can be billed above their spoken duration. The app links the live provider documents in first run and Settings because these facts can change.
Experimental local mode
A source install can expose local whisper.cpp only with VOICE_TRANSCRIBER_EXPERIMENTAL_LOCAL=1. You choose an executable and model; nothing downloads automatically. Linux speech is passed through a memory-backed descriptor, not a raw-audio file.
The chosen executable has your user-session authority. Treat it as trusted code: it could read or transmit the segment it receives. The current Flatpak disables this path, and the project does not call it a supported offline mode.
Text storage and deletion
The live transcript remains in GTK until you clear or close it. History is text-only, disabled by default, retention-limited, owner-only where POSIX permissions apply, and deletable per entry or all at once. Exports require a visible destination and confirmation.
Clipboard managers, explicit exports, backups, filesystem snapshots, and downstream apps then control their own copies. Flatpak removal with data deletion removes sandboxed settings/history but not exports you placed elsewhere.
Logs and diagnostics
App logs and --doctor are designed not to contain keys, audio, transcript content, provider response bodies, or local model paths. Diagnostics report booleans and normalized failures. Only --doctor --probe-provider contacts Groq, and it sends no audio.
Your control
You can inspect devices and privacy copy without a key, decline cloud setup, avoid Start, turn history off, clear the desk/history, remove saved configuration, and uninstall with sandbox data removal.
Read the complete notice and threat model. Report unintended transmission or secret exposure privately through the security policy; never attach a real key, recording, or transcript.